envoyproxy / envoyproxy/envoy

Pausing filter chain on http request body doesn't work for dynamic forward proxy. It works when envoy is reverse-proxy.

Open
#17,514 15 comments 0 reactions 0 assignees View on GitHub
area/http investigate no stalebot
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 22h
Merged PRs (30d)
430

Description

I have a HTTP WASM filter where I make a http callout in the request body callback. After the callout, I return FilterDataStatus::StopIterationAndBuffer(which is 1) for this callback and want envoy to pause and wait for the callout reply to decide to stop or continue.

This works when envoy is reverse-proxy. However, when envoy is dynamic-forward-proxy, the pause didn't happen for the request body and the filter chain continued for the request body.

Looking at the log, for dynamic forward proxy, it's possible that after DNS is resolved asynchronously(which was triggered by http request headers), when it tried to continue the filter chain, it didn't check for the filter chain's current status and continued even when a previous filter returned FilterDataStatus::StopIterationAndBuffer.

```
[2021-07-23 01:24:03.141][558823][trace][wasm] [source/extensions/common/wasm/wasm_vm.cc:39] [host<-vm] proxy_on_request_body return: 1
[2021-07-23 01:24:03.141][558823][trace][http] [source/common/http/filter_manager.cc:676] [C0][S12846879879184174189] decode data called: filter=0x47c1bd46cf50 status=1
[2021-07-23 01:24:03.141][558823][trace][http] [source/common/http/http1/codec_impl.cc:613] [C0] parsed 223 bytes
[2021-07-23 01:24:03.141][558823][debug][upstream] [source/common/upstream/cluster_manager_impl.cc:1250] membership update for TLS cluster dynamic_forward_proxy_cluster added 1 removed 0
[2021-07-23 01:24:03.141][558823][debug][upstream] [source/common/upstream/cluster_manager_impl.cc:1257] re-creating local LB for TLS cluster dynamic_forward_proxy_cluster
[2021-07-23 01:24:03.142][558823][debug][forward_proxy] [source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.cc:142] [C0][S12846879879184174189] load DNS cache complete, continuing
[2021-07-23 01:24:03.142][558823][trace][http] [source/common/http/filter_manager.cc:70] [C0][S12846879879184174189] continuing filter chain: filter=0x47c1bd46d030
[2021-07-23 01:24:03.142][558823][debug][router] [source/common/router/router.cc:448] [C0][S12846879879184174189] cluster 'dynamic_forward_proxy_cluster' match for URL '/'
[2021-07-23 01:24:03.142][558823][debug][router] [source/common/router/router.cc:634] [C0][S12846879879184174189] router decoding headers:
```

In the above log, when "load DNS cache complete, continuing", looks like it didn't check the fact that a filter previously returned 1(FilterDataStatus::StopIterationAndBuffer) for the request body. Can someone confirm if this is a bug? I can provide the repro code if needed.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.